The Arista MLS layer 2 switch must enable Unidirectional Link Detection (UDLD) to protect against one-way connections.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-255978	ARST-L2-000150	SV-255978r882276_rule		Medium

Description
In topologies where fiber optic interconnections are used, physical misconnections can occur that allow a link to appear to be up when there is a mismatched set of transmit/receive pairs. When such a physical misconfiguration occurs, protocols such as STP can cause network instability. UDLD is a layer 2 protocol that can detect these physical misconfigurations by verifying that traffic is flowing bidirectionally between neighbors. Ports with UDLD enabled periodically transmit packets to neighbor devices. If the packets are not echoed back within a specific time frame, the link is flagged as unidirectional and the interface is shut down.

Description

In topologies where fiber optic interconnections are used, physical misconnections can occur that allow a link to appear to be up when there is a mismatched set of transmit/receive pairs. When such a physical misconfiguration occurs, protocols such as STP can cause network instability. UDLD is a layer 2 protocol that can detect these physical misconfigurations by verifying that traffic is flowing bidirectionally between neighbors. Ports with UDLD enabled periodically transmit packets to neighbor devices. If the packets are not echoed back within a specific time frame, the link is flagged as unidirectional and the interface is shut down.

STIG	Date
Arista MLS EOS 4.2x L2S Security Technical Implementation Guide	2023-01-11

Details

Check Text ( C-59654r882274_chk )
If any of the switch ports have fiber optic interconnections with neighbors, review the Arista MLS switch configuration to verify that Loop Guard is enabled globally or on a per interface basis. switch# sh run \| sec spanning-tree spanning-tree guard loop default Or, interface Ethernet6 spanning-tree guard loop If the switch has fiber optic interconnections with neighbors and Loop Guard is not enabled, this is a finding.

Check Text ( C-59654r882274_chk )

If any of the switch ports have fiber optic interconnections with neighbors, review the Arista MLS switch configuration to verify that Loop Guard is enabled globally or on a per interface basis.

switch# sh run | sec spanning-tree
spanning-tree guard loop default

Or,

interface Ethernet6
spanning-tree guard loop

If the switch has fiber optic interconnections with neighbors and Loop Guard is not enabled, this is a finding.

Fix Text (F-59597r882275_fix)
Configure the Arista MLS switch to enable Loop Guard to prevent Unidirectional Link Detection (UDLD) and to protect against one-way connections. switch(config)#spanning-tree guard loop default switch(config)# Alternatively, configure Loop Guard on each interface: switch(config-if-Eth6)# spanning-tree guard loop Note: UDLD is a Cisco-proprietary protocol. However, other switch vendors, such as 3Com, Extreme, and D-Link, have similar functionality in their products, respectively: Device Link Detection Protocol (DLDP), Extreme Link Status Monitoring (ELSM), and D-Link Unidirectional Link Detection (DULD).

Fix Text (F-59597r882275_fix)

Configure the Arista MLS switch to enable Loop Guard to prevent Unidirectional Link Detection (UDLD) and to protect against one-way connections.

switch(config)#spanning-tree guard loop default
switch(config)#

Alternatively, configure Loop Guard on each interface:

switch(config-if-Eth6)# spanning-tree guard loop

Note: UDLD is a Cisco-proprietary protocol. However, other switch vendors, such as 3Com, Extreme, and D-Link, have similar functionality in their products, respectively: Device Link Detection Protocol (DLDP), Extreme Link Status Monitoring (ELSM), and D-Link Unidirectional Link Detection (DULD).